AN APPROACH FOR THE THROUGH-LIFE ASSURANCE OF THE TECHNICAL INTEGRITY OF IMPACT BAG INFLATORS

AN APPROACH FOR THE THROUGH-LIFE ASSURANCE OF THE TECHNICAL INTEGRITY OF IMPACT BAG INFLATORS Greg Wilcock Peter Knights School of Mechanical and Mining Engineering The University of Queensland Australia Paper Number 17-0331 ABSTRACT Impact bag inflators contain energetic components that have finite lives as either a function of age or environment, or a combination of both. Because of their application these inflators are required to operate safely and at very high levels of reliability, in many cases after significant periods of storage and installation, and often in less than benign environments. Historically, there has been limited data available that provided assurance of the ongoing technical integrity of inflators through life leading to, at best, the tacit acceptance of higher levels of risk associated with the continued operation of these items. At worst, there is the possibility of unsafe operation of inflators. This paper proposes an ongoing program that builds on existing initial design certification and production acceptance test activities by conducting performance monitoring activities (termed surveillance activities) on items that have experienced both typical and more severe environments over their expected design life. This program has its basis in Configuration Management (CM), which provides a sound engineering framework for determining the safety status and performance of inflators. The program mitigates many of the asset management risks, is cost effective, easily targeted at inflators that have experienced more extreme environments and, as a continuous operation, provides ongoing confidence in the safety and performance of inflators. INTRODUCTION Impact bag inflators contain energetic components that have finite lives as either a function of age or environment, or a combination of both. Because of their application these inflators are required to operate safely and at very high levels of reliability, in many cases after significant periods of storage and installation, and often in less than benign environments. Being one-shot or single use devices these items cannot be tested and, if found serviceable, reinstalled into the vehicle safety system. Historically, there has been limited data available that provided assurance to manufacturers (that is, the Original Equipment Manufacturer (OEM)), higher assembly vehicle manufacturers (or vehicle OEMs) and regulating authorities of the ongoing technical integrity of inflators through-life leading to, at best, the tacit acceptance of higher levels of risk associated with the continued operation of these items. At worst, the degradation of these energetic components can have, and has been shown to have, catastrophic effects on performance [1]. One mitigation strategy to prevent the use of unacceptably degraded inflators, the associated loss of confidence in the technical integrity of inflators generally, and the significant costs associated with vehicle recall activities, is to adopt a rigorous configuration management strategy that includes, among other aspects, an audit program whose results provide necessary assurance to OEMs and regulating authorities of the ongoing safety and performance of inflators. Such a program is, typically, part of a larger multi-stage test program. OBJECTIVE This paper provides background on the requirement for through-life monitoring of the performance of inflators, the engineering framework within which such monitoring could occur, and an outline of the type of activities that should be considered as part of a safety and performance monitoring program. Specifically, this paper will: a. discuss the characteristics of inflators which, because of their design, require specific asset management strategies, including performance monitoring; b. define the term technical integrity; c. explain the elements and advantages of adopting a configuration management framework to assure the technical integrity of inflators; and G.Wilcock 1

d. outline an audit program for inflators. Note that this paper is not a review of USCAR24-2 Inflator Technical Requirements and Validation [2], and assumes that the standard adequately addresses initial design certification and production acceptance requirements for inflators. CHARACTERISTICS OF INFLATORS Impact bag inflators contain energetic materials which have been found to degrade with both time and as a function of the environment to which the item is exposed [1]. Consequently, these items have a finite life (currently 15 years [2] 1 ) during which their performance would be expected to meet the requirements of the item s Function and Performance Specification (FPS) 2. Because these items contain energetic materials and are required to operate in a Safety Critical System (SCS) 3, the items have a number of common characteristics that distinguish them from nearly all other vehicle safety components. That is, the items: a. in most cases, are never required to operate and hence may only be replaced during scheduled maintenance activities or removed from the vehicle at the end of the vehicle s life; b. are not repairable; c. may be stored for long periods of time prior to installation in the vehicle; d. may be installed for long periods of time within the vehicle, potentially experiencing extremes of environments; e. are not subjected to any maintenance activity; f. if they are required to operate, and because of the criticality of SCSs, the FPS requires the items to have very high levels of reliability; g. in many cases, have limited performance data (that is, against FPS requirements) following installation into vehicles and 1 Requirement (para) 3.1.1 2 An FPS defines a validated set of requirements for a capability system in terms of functions and needs without reference to a specific solution. 3 A SCS can be defined as a system whose failure could result in loss of life, significant property damage, or damage to the environment [14]. subsequent exposure to operating environments; and h. unlike most other items of mechanical or electronic equipment, cannot be tested at any point in time and, if found to be serviceable, reinstalled for a further period of service. Each of the above characteristics would, in isolation, provide logistics and engineering challenges for any asset management system. Collectively, these characteristics demand specialised asset management techniques to ensure the safe and effective operation of the inflators throughout their life. TECHNICAL INTEGRITY Technical integrity can be defined as an item s: a. suitability for service, which is the item s ability to satisfy the requirements of its FPS within a defined environment when operated or used as intended; b. design safety, which is freedom from those conditions during storage, transport and operation that can cause death, injury, or occupational illness; and c. compliance with regulations for environmental protection; that is, where the item poses no hazard to the environment [3]. Importantly, the status of an item s technical integrity is the basis for deciding the item s sustainability for, and confidence in, continued use. In confirming an item s technical integrity, it is assumed that the item has been designed, constructed and maintained to approved standards by competent and authorised individuals (the manufacturer s responsibility), who are acting as members of an approved organisation (the manufacturer s organisation), and whose work is certified as correct and accepted on behalf of the operating organisation (in this case, the higher assembly vehicle OEM). To assure the technical integrity of any item there should be adequate provision by way of reviews and audits, to ensure the design intent is unimpaired in any way that could cause undue risk or harm to people or damage to the environment [4]. Additionally, Bale et al. (2010) quotes a BP document that states that the technical integrity will only be maintained by the application of operational integrity assurance systems [4]. Rahim et al. (2010) recognise that the effective G.Wilcock 2

management of technical integrity leads to reduced risk exposure [5]. Technical Integrity Through-Life. To adequately reduce risk and ensure the required capability, the technical integrity of an item must be maintained throughout all phases of its defined life-cycle, which will include storage, transport, installation, operation and disposal. Consequently, in the case of inflators, the requirement is that the inflators are: a. safe to store and transport, b. safe to remain installed in a vehicle, and c. operate safely when required to the limits of their FPS, all within a defined environment, termed the Manufacturer to End Use Environment (MEUE). Additionally, inflators must be safe to be disposed of at the end of the life cycle. Consequently, any reviews and audits that are established need to confirm the technical integrity of an item within these bounds. CONFIGURATION MANAGEMENT TO ASSURE TECHNICAL INTEGRITY Background. The requirement for the establishment and maintenance of technical integrity typically sits within an engineering and asset management system. Such systems commonly use configuration management (CM) as part of their approach to the establishment and maintenance of technical integrity. CM was developed and adopted within the aerospace industry and by the US Department of Defense in the late 1960s and 1970s, later resulting in a number of military specifications such as MIL-STD-972 (now superseded), and the current international industry standard ANSI/EIA- 649B [6]. ANSI/EIA-649B defines CM as a management process for establishing and maintaining consistency of a product s performance, functional, and physical attributes with its requirements, design and operational information throughout its life. Rather than being aerospace or defence industry specific, this standard now provides a general industry view of CM by documenting and explaining its essential principles independent of specific industry practices [7]. Importantly, CM is now being recognised by some vehicle OEMs as an essential part of an engineering management system, particularly as they adopt a functional approach to systems engineering rather than a component based approach [8]. Role of Configuration Management. CM can be seen as a technical discipline applied to manage the evolving design of items and, in general terms, can include items of equipment and associated software, support and test equipment, and documentation. It is also widely recognised that CM plays a vital part in a product s life cycle to provide visibility and control on levels of performance and status [9]. Similarly, CM can have a central role in the establishment and maintenance of technical integrity of vehicle components including inflators. CM Activities. In general terms, CM is made up of four activities which involve: a. identifying and recording the physical and functional characteristics of items; b. controlling design changes to those items, usually within an engineering design change management system; c. recording the status of the configuration of those items, including the documentation and data that describes those items; and d. regularly auditing and verifying physical characteristics against design documents, and the functional performance of the item against its FPS, termed configuration verification and audit. More detailed descriptions of CM activities are available in dedicated CM publications, papers and standards [6] [10] [11]. CONFIGURATION VERIFICATION AND AUDIT Assuming that the design, development and management of the design of inflators can occur, or is occurring, within a CM or CM-like environment, the ongoing maintenance of the technical integrity of the inflators can therefore, in part, be achieved by the regular audit of functional characteristics of the item against its FPS. This is achieved by the conduct of physical configuration audits (PCA) which, primarily, confirm the build standard of inventory items, and functional configuration audits (FCA), which confirm the safe and effective performance of inventory items against an FPS. To assure technical integrity, PCAs and FCAs are usually conducted as part of a larger multi-stage test and certification program over the item s lifecycle. This larger program typically consists of: a. initial design certification activities. These test activities are designed to provide the initial assurance of technical integrity of the design prior to acceptance into service. That is, these design acceptance activities G.Wilcock 3

demonstrate, via either evidence or argument, compliance with the requirements of the defined design certification basis; b. production acceptance testing, to ensure production items are representative of the design that was originally certified, and would typically include the same testing that is to be conducted through-life; c. through-life testing (FCA and PCA) to assure production items continue to meet ongoing technical integrity requirements over the item life defined in the FPS; and d. end of life assessment of technical integrity, to ensure the safety and environmental requirements for safe disposal are met. Initial design certification and production acceptance activities are currently conducted in accordance with USCAR24-2 [2] and are an integral part of establishing the technical integrity of inflators. PCA AND FCA FOR INFLATORS PCAs and FCAs for energetic items, such as inflators, can also be referred to as surveillance activities. These activities would include the ongoing testing and analysis of representative samples of inflators, in statistically significant quantities, that have experienced both the typical and more extreme operating environments. Importantly, these surveillance activities do not replicate initial design certification testing. Rather, this testing involves the measurement of selected performance parameters, termed Critical Performance Parameters (CPP), that are based on the requirements of the FPS. These CPPs should be measured at production acceptance and then at defined intervals during the lifecycle of the inflators. The selection of CPPs, quantity of items to be tested and frequency of testing needs to be carefully managed to ensure that the items tested are representative of the inventory and of the operating environments, and provide the required level of statistical confidence to support design and inventory management decisions. That is, the frequency of activities should be such that costs are minimised whilst being sufficiently frequent to enable trends in CPP performance to be recognised early. Consequently, the extent of the PCA/FCA surveillance activities to be conducted needs to be sufficient to provide the evidence and/or argument that is required to show ongoing compliance against the design requirements and FPS, though should be proportional to the risk to technical integrity posed by non-compliance. Irrespective, the program is likely to be of minimal cost compared to the potential costs of recall programs and/or litigation. Importantly, these surveillance activities, conducted within a CM framework, are consistent with the principles of ISO 55000:2014 Asset Management and ISO 31000:2009 Risk Management [12] [13]. PCA/FCA SURVEILLANCE ACTIVITIES A surveillance program for returned inflators 4 that is cost effective and is likely to provide sufficient early warning of deviations from FPS requirements may consist of: a. visual inspection of test items, including checking for indications of potential malfunction, and may include inspections for general condition, evidence of corrosion and/or swelling of the inflator body; b. inflator performance test, though noting that a time-to-inflation test may be adequate in lieu of a full pressure-time test (noting the potentially higher cost of the latter); and c. structural integrity test (currently conducted in accordance with USCAR24-2 and as part of the performance test above). Depending on the results of these surveillance activities dedicated defect investigation programs, including subsequent additional testing, may be required. Quantities for Surveillance. Given the reduced numbers of parameters being measured in this surveillance program (and therefore reduced cost of testing) compared to the number of individual test activities required by the USCAR24-2 Design Verification (DV)/Production Validation (PV) test program, and the large number of items installed in vehicles and so available for testing, a surveillance program that tests a more than statistically significant quantity (that is, more than the 15 test items required by USCAR24-2 for DV/PV testing) could occur. Sampling for Surveillance. Sampling should consist of both probabilistic as well as nonprobabilistic sampling, the latter being useful to 4 These returned inflators, having already experienced the operating environment (or MEUE), would not be conditioned prior to testing. G.Wilcock 4

identify, for example, fleet leaders in terms of both age and exposure to extreme environments. Specialist statistical advice on statistically significant sample sizes is typically available from within vehicle OEMs and/or regulators, noting the extant USCAR24-2 requirement for item reliability. Given the criticality of these items and the likely minimal cost of proposed surveillance testing, vehicle OEMs and/or regulators may wish to consider increasing the reliability and confidence limit requirements of USCAR24-2. Production Lot v. Design Based Lifing. The numbers of items required for testing will also depend on the basis that has been assumed for variations in performance due to production. That is, if there is significant performance differences between manufactured lots (identified during production acceptance test activities) then a surveillance strategy based on production lots, requiring testing of returned items from all production lots having experienced all environments, would be required. Alternatively, if there is an ongoing acceptably small variation in performance between production lots, and those variations are not likely to be exacerbated following natural ageing and exposure to the operating environment, then a design based approach to surveillance (that is, an assumption is made that all lots are homogeneous in performance against the FPS) will significantly reduce quantities required for testing. Irrespective, items selected for surveillance, in addition to samples from more benign operating environments, should include those that are more likely to have experienced environments that have been shown to generate failure modes (that is, thermal cycling, high humidity etc.). Other Surveillance Considerations. Given the design characteristics of these components (that is, single shot, energetic material, SCS etc.), there are a number of additional considerations when conducting these surveillance activities. These include: a. the type of statistical distribution appropriate for this data. In many cases the performance of energetic components has been assumed to follow a normal distribution. For these components consideration of a Weibull distribution for performance may be more appropriate; and b. the effect of censored data, and particularly left censored data, on trend analysis and reliability calculations. SURVEILLANCE PROGRAM SUMMARY The proposed approach for the through-life assurance of the technical integrity of inflators: a. has a sound engineering basis, being based on the requirements of a CM system; b. is cost effective, given that surveillance requires the testing of only a limited number of CPPs, reducing program costs; c. ensures the testing of items that have experienced more extreme environments considered to be major causes for item failure; d. is in constant operation, allowing trends in performance to be identified with the subsequent timely implementation of appropriate risk mitigation strategies; and e. is likely to identify changes in safe operation and/or performance of inflators due to: (1) changes in configuration, perhaps caused by a sub-contractor making changes to production processes and/or materials; (2) changes in operating environments; (3) changes in maintenance policies (such as the requirement to replace airbags more frequently in some jurisdictions); and (4) the acceptance of production permits 5 and/or deviations 6 by the item OEM or OEM sub-contractors. The data generated by the surveillance can be used to: a. quantify the effect of environments on the design of inflators, 5 A production permit can be defined as a variation from item specification or configuration agreed to before production and, within a CM system, results in an item termed the Build Standard (that is, a Product Baseline plus an approved Engineering Change Proposal (ECP)). 6 A production deviation can be defined as a variation from item specification or configuration agreed to after production and, within a CM system, results in an item termed the Approved Build State (that is, the Build Standard plus an approved Request For Variation (RFV)). G.Wilcock 5

b. quantify the design reliability of inflators at any stage of their design life to statistically acceptable levels, c. estimate the remaining useful life of installed airbags given an intended or known environmental exposure profile, d. mitigate the risk associated with expensive vehicle component recalls, and e. assure the through-life technical integrity of inflators and, consequently, public safety. CONCLUSION This paper presents a strategy for the ongoing assurance of the technical integrity of impact bag inflators. The results of the surveillance program provide assurance to manufacturers, higher assembly vehicle manufacturers and regulating authorities that inflators remain safe to store, transport, and remain installed in that vehicle safety critical system, and still operate when required to the limits of their Function and Performance Specification (FPS). This surveillance program has its basis in CM, which provides a sound engineering framework for determining the safety status and performance of inflators. The program mitigates many of the asset management risks, is cost effective, easily targeted at inflators that have experienced more extreme environments and, as a continuous operation, provides ongoing confidence in the safety and performance of inflators. Acronyms CM Configuration Management CPP Critical Performance Parameter FPS Function and Performance Specification MEUE Manufacturer to End Use Environment OEM Original Equipment Manufacturer SCS Safety Critical System References [1] H. Blomquist, Expert Report for United States Department of Transportation National Highway Traffic Safety Administration - Airbag Inflator Rupture, Transportation National Highway Traffic Safety Administration, 2015. [2] SAE International, USCAR 4-2 Inflator Technical Requirements and Validation, 2013. [3] Department of Defence (DTC-AF), Australian Air Publication 7001.059 ADF Aviation Maintenance Management Manual, Australian Defence Force, 20 Mar 2013. [4] E. Bale and D. Edwards, Technical Integrity - An Engineer's View, Institution of Chemical Engineers, Trans IChemE, Vol 78, Part B, September 2000. [5] Y. Rahim, I. Refsdal and R. Kenett, The 5C model: A new approach to asset integrity management, vol. 87, International Journal of Pressure Vessels and Piping, 2010. [6] SAE International, EIA 649B Configuration Management Standard, 2011. [7] A. Lager, The Evolution of Configuration Management Standards, Logistics Spectrum; Jan-Mar 2002; 36, 1; Research Library pp 9-12, 2002. [8] O. Kluge and R. Klement, Configuration Management for Electronics in Automotive Engineering, Detroit, Michigan: SAE International Systems Engineering, Electronics Simulation, Advanced Electronics Packaging, and Electromagnetic Compatibility, 2005. [9] U. Ali and C. Kidd, Critical Success Factors for Configuration Management Implementation, Industrial Management & Data Systems, 2013 Vol. 113 No. 2, pp. 250-264. [10] US Department of Defense, MIL-HDBK-61A Configuration Management Guidance, 2001. [11] M. Kelly, Configuration Management: The Changing Image, London ; New York: McGraw-Hill Book Co., 1996. [12] ISO 55000 Asset Management - Overview, principles and terminology, Geneva, 2014. [13] ISO 31000 Risk Management - Principles and guidelines, Geneva, 2009. [14] J. C. Knight, Safety Critical Systems: Challenges and Directions, Orlando, FL: Proceedings of 24th International Conference on Software Engineering, 2002. G.Wilcock 6